Welcome back, aspiring cyberwarriors and OSINT investigators!
During the OSINT investigation, we might find a situation where a target has a presence on the Discord platform. According to Demadsage, there are 259 million monthly active users on Discord. Therefore, leaving this source of intelligence would be unwise. But unlike regular social media, Discord’s data is kept in semi-private “servers,” so investigators have to engage actively and correlate the data rather than just observe through third-party tools. And this requires more investment in tools and awareness of visibility risks.
Therefore, in this article, we will explore the first steps to get started with OSINT on Discord users. Let’s get rolling!
Discord has powerful built-in search, which acts like a localized “Dorking” system. To get started using it, we just need to click on the top-right search form. As you can see below, it has 4 core operators for filtering.
| Operator | Functional Logic | Investigative Application |
|---|---|---|
| from: | Filters messages by a specific user. | Isolate the entire chat history of a person of interest to map behavioral patterns and communication style. |
| has: | Filters for specific message contents (link, file, video, image). | Intercept high-value artifacts. |
| in: | Limits search to a specific channel. | Filter the investigation to high-signal channels like #introductions or #portfolio |
| mentions: | Filter messages by mentioned user | Check who communicated with a mentioned user |
Besides that, Discord offers 3 more filters after clicking “More filters”.
This built-in search serves as a good start for investigation. Just by writing a good query, you can sort through tens of thousands of messages. And sometimes, even find leaked access credentials.
Another important thing here is the images. Sometimes folks shared photos from their college graduation years ago or a first-day-on-the-job photo. Or even some family photos. Therefore, even with simple search filters, a lot of interesting data can be found.
One of the easiest ways to find the real name of a Discord user is to look into linked accounts. Originally, Discord was built for gamers, and these linked accounts were intended to share in-game status and activities. But eventually, the list of supported services grew very long, and now users can connect their Facebook, GitHub, and even PayPal accounts.
In the screen above, we can see a list of services and a YouTube channel, which appears to be a real name.
In Discord, every user can create a different username for every server they join.
This is useful because users might set up their real names or provide additional information for the investigation on other servers. To check it, just click “View full profile” and then the three dots.
A Discord ID is a unique 18-digit number, and everyone has one. Users, messages, servers, and even bots all have one. The advantage of this is that while a username can be changed, a user’s ID cannot. Discord, in turn, uses these IDs to store all user data, including the history of name changes.
To find a Discord ID, all we need to do is enable developer mode. To do this, click the gear icon next to your name (in the lower-right corner), and in the settings menu that opens, look for the “Developer” section. There, enable “Developer Mode.”
Now find the user you’re looking for and click on their name. An actions menu will open; you’ll see three dots. Click on them, and you’ll see the “Copy User ID” button.
After gathering the user’s ID, we can move into the usage of dedicated tools for Discord OSINT. One of them is the Cord.cat website. The core function of Cord.cat is resolving a Discord “snowflake” (the numeric user ID) into a complete, sourced picture of the account. But beyond basic profile data, the platform checks for breaches, FiveM records, and DSA sanctions. To get started, we just need to enter the user’s ID on the website. You will see output like below.
Here we can see that this account wasn’t found in breaches; there are no sanctions, etc. On the left, we can see the account creation date and links to download the avatar, decorations, and nameplate. By scrolling below, we can see more info.
We can see that the user has a low risk score according to the assessment. If we scroll down, we can see additional information like this.
We can see servers where this user is joined, and we can see whether this ID has an account on Discord-related websites.
Discord has huge potential for OSINT. Especially if we look into it not just as a communications channel for gamers, but as a tool for a wide range of people, where there are even cases when companies use this tool for employee communications. Although it has semi-private servers, with the correct approach, this social platform can provide good intelligence.
If you’re looking to enhance your OSINT skills, consider exploring OSINT training. If you need assistance in uncovering the truth, don’t hesitate to reach out to us at hackers-arise@protonmail.com, and we’ll conduct a comprehensive OSINT investigation for you.
The post Open Source Intelligence (OSINT): Gathering Information on Discord Users first appeared on Hackers Arise.
For a long time I used Discord webhooks for notifications from my services. It was easy, it worked and almost every application knew how to send something to Discord. Create a private channel, copy a webhook URL, paste it into a service and wait until something breaks. Very advanced engineering.
The more services I added, however, the
Login